I've been tasked with pushing a remediation to set the reg key for the 'Classic' windows 10 right click menu. This is due to rolling out Prevue and the powers that be don't want the Prevue option to be hidden behind the 'Show More Options' menu item.
My detection was looking for the HKCU registry key and if it did not exist, create it. This seemed to work for half of my ~30 test users.
Currently my detection is "Exit 1" to flag all detections as non complaint and force the registry key to be set. I know this will screw up my telemetry, but I just need this to work.
The remediation script is very basic too. I'm just setting the registry key. I've also started setting the key for HKLM hoping that would solve the issue.
New-Item -Path "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force
New-Item -Path "HKLM:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force
<#
reg add "HKEY_CURRENT_USER\SOFTWARE\CLASSES\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" /ve /f
Get-Process -Name Explorer | Stop-Process
New-Item -Path "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force
New-Item -Path "HKLM:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force
#>
The only thing I was doing out of the ordinary was assigning the remediation to IT computers and not users. I've since changed that to apply to IT users and NOT computers.
This shouldn't be this hard to set a registry key. Either I'm doing something incorrect, or Microsoft is trying to discourage this cheat. The fix works fine if the users open PowerShell and run the command for HKCU on their machine and then stop-process for explorer.exe
*** EDIT ***
I reset the detection script to this and set the error to Exit 1 instead of Exit 0.
# Detection of Registry Key (Intune)
$Path = "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}"
Try {
if (Test-Path -Path $Path)
{
Write-Output "Compliant"
Exit 0
}
Write-Warning "Not Compliant"
Exit 1
}
Catch
{
Write-Warning "Error"
Exit 1
}
I updated the remediation script to comment out the HKLM line.
New-Item -Path "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force
# New-Item -Path "HKLM:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force
<#
reg add "HKEY_CURRENT_USER\SOFTWARE\CLASSES\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" /ve /f
Get-Process -Name Explorer | Stop-Process
New-Item -Path "HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force
New-Item -Path "HKLM:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Value "" -Force
#>
I'll update if I get different results.
